agent-platform release v4.68.2

The Substrate bootstrap hook’s kubectl container is limited to 256Mi, the connectivity chart’s other hook containers stay at 128Mi (giantswarm/agent-platform#513). The bootstrap script runs up to two kubectl processes at once (kubectl create --dry-run=client | kubectl apply --server-side for actor-id-ca-certs, kubectl into jq for the trust anchors), each some 30 MiB resident, next to jq, the shell and the key candidates on its in-memory /work, all charged to the pod’s memory cgroup. At the shared 128Mi limit the Job’s first pod was OOM-killed on a busy node and the install completed only on the Job’s retry; a hook that exhausts its backoffLimit fails the release. agent-platform.hooks.job takes an optional memory (the main container’s limit, default 128Mi); the bootstrap passes 256Mi. Every request stays 10m/32Mi, the openssl init container keeps 128Mi. make verify-hooks-memory asserts the four hook Jobs’ resources.